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Claims 



What is claimed is: 



2 
3 
4 
5 



1. 
(a) 
(b) 
(c) 



1 2. 
2 

1 3. 
2 

1 4. 
2 

1 5. 
2 



1 6. 
2 



A method for 



receiving accounting information over a packet-switched network; 



monitoring at 
discarding at 



processing network accounting information, comprising: 



least one aspect of the received accounting information; and 
east a portion of the accounting information based on the 



monitored aspect 

The method ks recited in claim 1 , wherein the accounting information is 
discarded foi providing a defense against network attacks. 

The method as recited in claim 1 , wherein the accounting information is 
discarded foj: dealing with heavy network traffic. 



The method 
summary 



as recited in claim 3, and further comprising generating a 
oflthe accounting information. 



The method 
of the receh 
plurality of >orts 



The method 



as recited in claim 1 , wherein monitoring the at least one aspect 
ed accounting information includes detecting a scan of a 



as recited in claim 1 > wherein monitoring the at least one aspect 
of the received accounting information includes detecting a scan of a 
plurality on Internet Protocol (IP) addresses. 



1 7. The methop as recited in claim 1 , wherein monitoring the at least one aspect 

2 of the received accounting information includes monitoring a rate of receipt 

3 of the accounting information. 
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8. The method as recited in claim 7, wherein monitoring the at least one aspect 
of the received accounting information includes detecting whether the rate of 
receipt of the accounting information exceeds a predetermined amount. 



9. The method as reciied in claim 1 , wherein monitoring the at least one aspect 
of the received accounting information includes monitoring a load on a 



system receiving t 



e accounting information. 



10. The method as rec ted in claim 1 , wherein the network includes the Internet. 



receiving accounting information over a packet-switched 



11. A computer progn im product for processing network accounting information, 
comprising: 

(a) computer code for 
network; 

(b) computer code foij monitoring at least one aspect of the received accounting 
information; and 

(c) computer code foil i 
based on the mon: 



accounting infor 
attacks. 



discarding at least a portion of the accounting information 
tored aspect. 



12. The computer pro jram product as recited in claim 1 1 , wherein the 



ition is discarded for providing a defense against network 



13. The computer program product as recited in claim 1 1, wherein the 

accounting infon nation is discarded for dealing with heavy network traffic. 



14. The computer 
computer code 



program product as recited in claim 13, and further comprising 
fop* generating a summary of the accounting information. 
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15. 



16. 



The computer prografn 
code for monitoring 
information includes) compufc 
Internet Protocol (IP 
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product as recited in claim 1 1 , wherein the computer 
he at least one aspect of the received accounting 

;er code for detecting a scan of a plurality of 
addresses. 



The computer program product as recited in claim 1 1 , wherein the computer 
code for monitoringlthe at least one aspect of the received accounting 
information includes computer code for monitoring a rate of receipt of the 
accounting informaftion. 



1 

2 
3 
4 

1 
2 
3 
4 

1 
2 
3 
4 

1 
2 
3 
4 



17. 



18. 



20. 
(a) 
(b) 



The computer program product as recited in claim 16, wherein the computer 
code for monitoring the at least one aspect of the received accounting 
information includes computer code for detecting whether the rate of receipt 
of the accounting finformation exceeds a predetermined amount. 



The computer p: 
code for 
information inc 
ports 



gram product as recited in claim 1 1 , wherein the computer 
monitojing the at least one aspect of the received accounting 

udes computer code for detecting a scan of a plurality of 



1 9. The computer p rogram product as recited in claim 1 1 , wherein the computer 
code for monitoring the at least one aspect of the received accounting 
information includes computer code for monitoring a load on a system 
receiving the accounting information. 

A system for wocessing network accounting information, comprising: 
logic for rece iving accounting information over a packet-switched network; 
logic for mor itoring at least one aspect of the received accounting 
information; ind 
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logic for discarding at least a portion of the accounting information based on 
the monitored aspecj. 

A method for processing network accounting information, comprising: 
receiving accounting information over a packet-switched network; 
monitoring at leasuone aspect of the received accounting information; and 
conditionally preventing an overload of the accounting information based on 
the monitored aspect. 

A method for processing network accounting information, comprising: 
receiving accounting information over a packet-switched network; 
receiving an indication relating to at least one aspect of the received 
accounting information; and 

conditionally preventing an overload of the accounting information based on 
the indicatior 

A method for processing network accounting information, comprising: 
receiving ac< ;ounting information over a packet-switched network; 
detecting a s can of a plurality of ports; 

detecting a s can of a plurality of Internet Protocol (IP) addresses; 
detecting a iate of receipt of the accounting information; 
detecting whether the rate of receipt of the accounting information exceeds a 
predetermined amount; 

detecting a Load on a system receiving the accounting information; 



conditional! 



aspects detected during steps (b)-(f); and 



(h) generating a 



preventing an overload of the accounting information based on 



summary of the accounting information. 
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